PATCH UserResource and login correctly returns a CSRF token.